rpms
/
libsemanage
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

- Don't rebuild on fcontext or seuser modifications

This commit is contained in:
Daniel J Walsh 2008-08-14 20:17:19 +00:00
parent 8bffda7314
commit 5142c61edd
2 changed files with 126 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

126
libsemanage-rhat.patch
View File

@ -1,6 +1,60 @@
diff --exclude-from=exclude -N -u -r nsalibsemanage/src/genhomedircon.c libsemanage-2.0.25/src/genhomedircon.c
diff --exclude-from=exclude -N -u -r nsalibsemanage/src/direct_api.c libsemanage-2.0.27/src/direct_api.c
--- nsalibsemanage/src/direct_api.c 2008-06-12 23:25:16.000000000 -0400
+++ libsemanage-2.0.27/src/direct_api.c 2008-08-14 11:51:15.000000000 -0400
@@ -489,12 +489,6 @@
modified |= ifaces->dtable->is_modified(ifaces->dbase);
modified |= nodes->dtable->is_modified(nodes->dbase);
- /* FIXME: get rid of these, once we support loading the existing policy,
- * instead of rebuilding it */
- modified |= seusers_modified;
- modified |= fcontexts_modified;
- modified |= users_extra_modified;
-
/* If there were policy changes, or explicitly requested, rebuild the policy */
if (sh->do_rebuild || modified) {
@@ -667,11 +661,34 @@
retval = semanage_verify_kernel(sh);
if (retval < 0)
goto cleanup;
- }
+ } else {
+ sepol_policydb_create(&out);
+ modified |= seusers_modified;
+ modified |= fcontexts_modified;
+ modified |= users_extra_modified;
+
+ retval = semanage_read_policydb(sh, out);
+ if (retval < 0)
+ goto cleanup;
+
+ dbase_policydb_attach((dbase_policydb_t *) pusers_base->dbase,out);
+ dbase_policydb_attach((dbase_policydb_t *) pports->dbase, out);
+ dbase_policydb_attach((dbase_policydb_t *) pifaces->dbase, out);
+ dbase_policydb_attach((dbase_policydb_t *) pbools->dbase, out);
+ dbase_policydb_attach((dbase_policydb_t *) pnodes->dbase, out);
- /* FIXME: else if !modified, but seusers_modified,
- * load the existing policy instead of rebuilding */
+ if (seusers_modified) {
+ retval = pseusers->dtable->clear(sh, pseusers->dbase);
+ if (retval < 0)
+ goto cleanup;
+ }
+ retval = semanage_base_merge_components(sh);
+ if (retval < 0)
+ goto cleanup;
+
+ /* Seusers */
+ }
/* ======= Post-process: Validate non-policydb components ===== */
/* Validate local modifications to file contexts.
diff --exclude-from=exclude -N -u -r nsalibsemanage/src/genhomedircon.c libsemanage-2.0.27/src/genhomedircon.c
--- nsalibsemanage/src/genhomedircon.c 2008-08-05 09:57:28.000000000 -0400
+++ libsemanage-2.0.25/src/genhomedircon.c 2008-07-17 14:32:45.000000000 -0400
+++ libsemanage-2.0.27/src/genhomedircon.c 2008-08-08 14:00:37.000000000 -0400
@@ -21,6 +21,7 @@
*/
@ -25,12 +79,76 @@ diff --exclude-from=exclude -N -u -r nsalibsemanage/src/genhomedircon.c libseman
{NULL, NULL}
};
Ustr *line = USTR_NULL;
diff --exclude-from=exclude -N -u -r nsalibsemanage/src/semanage.conf libsemanage-2.0.25/src/semanage.conf
diff --exclude-from=exclude -N -u -r nsalibsemanage/src/semanage.conf libsemanage-2.0.27/src/semanage.conf
--- nsalibsemanage/src/semanage.conf 2008-06-12 23:25:16.000000000 -0400
+++ libsemanage-2.0.25/src/semanage.conf 2008-07-17 13:58:44.000000000 -0400
+++ libsemanage-2.0.27/src/semanage.conf 2008-08-08 14:00:37.000000000 -0400
@@ -35,4 +35,4 @@
# given in <sepol/policydb.h>. Change this setting if a different
# version is necessary.
#policy-version = 19
-
+expand-check=0
diff --exclude-from=exclude -N -u -r nsalibsemanage/src/semanage_store.c libsemanage-2.0.27/src/semanage_store.c
--- nsalibsemanage/src/semanage_store.c 2008-06-12 23:25:16.000000000 -0400
+++ libsemanage-2.0.27/src/semanage_store.c 2008-08-08 15:23:20.000000000 -0400
@@ -1648,6 +1648,47 @@
}
/**
+ * Read the policy from the sandbox (kernel)
+ */
+int semanage_read_policydb(semanage_handle_t * sh, sepol_policydb_t * in)
+{
+
+ int retval = STATUS_ERR;
+ const char *kernel_filename = NULL;
+ struct sepol_policy_file *pf = NULL;
+ FILE *infile = NULL;
+
+ if ((kernel_filename =
+ semanage_path(SEMANAGE_ACTIVE, SEMANAGE_KERNEL)) == NULL) {
+ goto cleanup;
+ }
+ if ((infile = fopen(kernel_filename, "r")) == NULL) {
+ ERR(sh, "Could not open kernel policy %s for reading.",
+ kernel_filename);
+ goto cleanup;
+ }
+ __fsetlocking(infile, FSETLOCKING_BYCALLER);
+ if (sepol_policy_file_create(&pf)) {
+ ERR(sh, "Out of memory!");
+ goto cleanup;
+ }
+ sepol_policy_file_set_fp(pf, infile);
+ sepol_policy_file_set_handle(pf, sh->sepolh);
+ if (sepol_policydb_read(in, pf) == -1) {
+ ERR(sh, "Error while reading kernel policy from %s.",
+ kernel_filename);
+ goto cleanup;
+ }
+ retval = STATUS_SUCCESS;
+
+ cleanup:
+ if (infile != NULL) {
+ fclose(infile);
+ }
+ sepol_policy_file_free(pf);
+ return retval;
+}
+/**
* Writes the final policy to the sandbox (kernel)
*/
int semanage_write_policydb(semanage_handle_t * sh, sepol_policydb_t * out)
diff --exclude-from=exclude -N -u -r nsalibsemanage/src/semanage_store.h libsemanage-2.0.27/src/semanage_store.h
--- nsalibsemanage/src/semanage_store.h 2008-06-12 23:25:16.000000000 -0400
+++ libsemanage-2.0.27/src/semanage_store.h 2008-08-11 09:05:16.000000000 -0400
@@ -97,6 +97,9 @@
sepol_module_package_t * base,
sepol_policydb_t ** policydb);
+int semanage_read_policydb(semanage_handle_t * sh,
+ sepol_policydb_t * policydb);
+
int semanage_write_policydb(semanage_handle_t * sh,
sepol_policydb_t * policydb);

5
libsemanage.spec
View File

@ -3,7 +3,7 @@
Summary: SELinux binary policy manipulation library
Name: libsemanage
Version: 2.0.27
Release: 1%{?dist}
Release: 2%{?dist}
License: LGPLv2+
Group: System Environment/Libraries
Source: http://www.nsa.gov/selinux/archives/libsemanage-%{version}.tgz
@ -78,6 +78,9 @@ rm -rf ${RPM_BUILD_ROOT}
%{_mandir}/man3/*
%changelog
* Tue Aug 5 2008 Dan Walsh <dwalsh@redhat.com> - 2.0.27-2
- Don't rebuild on fcontext or seuser modifications
* Tue Aug 5 2008 Dan Walsh <dwalsh@redhat.com> - 2.0.27-1
- Update to upstream
* Modify genhomedircon to skip %groupname entries.